Assessing the Political Motivations Behind Ransomware Attacks

68 Pages Posted: 20 Jul 2023

See all articles by Karen Nershi

Karen Nershi

Stanford Internet Observatory

Shelby Grossman

Stanford University; Stanford University

Date Written: July 12, 2023


Although traditionally viewed as apolitical, recent developments suggest there may be connections between some ransomware groups and the Russian government. To better understand this relationship, we created a dataset of 4,194 ransomware victims posted to the dark web between May 2019 and May 2022. We find that Russia-based ransomware groups increased attacks before elections in several major democracies, and companies that curtailed operations in Russia after the invasion of Ukraine were more likely to be targeted; these findings suggest potential political motivations behind these attacks. We also analyze a major ransomware group's leaked internal communications, which show ties to the Kremlin. We argue that the Russian government maintains an informal cooperative relationship with groups by providing safe harbor from prosecution and receiving plausible deniability for attacks and access to skilled cyber actors. Our findings suggest ransomware presents an international security threat in addition to functioning as a form of crime.

Keywords: international security, cybercrime, ransomware, cybersecurity, international political economy

JEL Classification: F50, F51, F52

Suggested Citation

Nershi, Karen and Grossman, Shelby, Assessing the Political Motivations Behind Ransomware Attacks (July 12, 2023). Available at SSRN: or

Karen Nershi (Contact Author)

Stanford Internet Observatory ( email )

United States
9855109079 (Phone)

HOME PAGE: http://

Shelby Grossman

Stanford University

Stanford, CA 94305
United States

Stanford University

Stanford, CA 94305
United States

Do you have negative results from your research you’d like to share?

Paper statistics

Abstract Views
PlumX Metrics